Penetration Tester

We are looking for a Penetration Tester to work for our client. The ideal candidate aligns with the responsibilities and qualifications outlined below.

This is a great opportunity for an offensive security professional to actively probe, exploit, and help strengthen an organization's defenses across a wide range of environments, in a hybrid role based in Columbus, OH.

Responsibilities

• Conduct penetration tests across web applications, APIs, networks, infrastructure, and other enterprise environments
• Use offensive security tools and techniques to identify and exploit vulnerabilities in a controlled, methodical manner
• Apply frameworks such as MITRE ATT&CK and OWASP to guide testing methodology and attack path analysis
• Perform manual vulnerability validation to confirm real-world exploitability and risk
• Document findings clearly, translating technical vulnerabilities into business risk that resonates with stakeholders
• Provide actionable, prioritized remediation recommendations to technical teams
• Collaborate with security and engineering teams to retest and validate fixes
• Stay current on emerging attack techniques, tools, and vulnerability trends
• Support red team exercises or specialized engagements as needed

Qualifications

• 3-5+ years of hands-on penetration testing, offensive security, or ethical hacking experience
• Experience testing across web applications, APIs, networks, and broader infrastructure
• Hands-on proficiency with tools such as Burp Suite, Metasploit, Nmap, Kali Linux, or similar
• Strong understanding of MITRE ATT&CK, OWASP, exploitation techniques, and attack path analysis
• Excellent documentation and communication skills, with the ability to explain risk to technical audiences
• Relevant certifications (e.g., OSCP, GPEN, CEH) a plus

What Our Client Offers

• Genuine offensive security work across diverse environments, not a single narrow testing scope
• Support for pursuing advanced certifications like OSCP or GPEN
• Direct influence over how findings translate into real remediation, not just report delivery
• A security team that values curiosity and hands-on technical depth